Senior GRC Analyst

Semperis

. Own SOC, ISO, and HIPAA audit programs .

Posted 11/5/2026full-timeUnited StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in managing SOC, ISO, and HIPAA audit programs while ensuring compliance with regulatory frameworks such as FedRAMP and NIST. Proficient in risk management, security policy development, and leveraging GRC platforms for effective audit and compliance operations.

Highest-signal resume keywords

SOC 2 Type II Audit ExperienceISO 27001 Audit ExperienceGRC OperationsCISSP CertificationVanta Platform Configuration

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Information Security Risk ManagementCompliance AuditingSecurity Policy DevelopmentRisk AssessmentEvidence Collection AutomationCustomer Security Questionnaire ManagementM&A Due DiligenceControl MonitoringQuantitative Cyber Risk AnalysisIncident Response Planning

Soft Skills

Clear Written CommunicationInfluencing StakeholdersVerbal Communication

Tools & Technologies

VantaDrataOneTrustArcherServiceNow

Certifications & Qualifications

CISSPCRISCCISMCISA

Industry Keywords

GRCHIPAANIST 800-53FedRAMPCybersecuritySaaSRegulated IndustriesAudit Test Plan DevelopmentAI Governance FrameworksTrust Center Activities

Tech Stack

Tools & technologies

Cyber SecurityServiceNow

About the role

Key responsibilities & impact

Own SOC, ISO, and HIPAA audit programs
Own customer security questionnaires and due diligence requests
Maintain information security policies, standards, and procedures
Coordinate scoping, scheduling, evidence preparation, fieldwork, and reporting for SOC 2 Type II and ISO 27001 audits
Cover HIPAA Security and Breach Notification Rules audits
Support FedRAMP and other compliance frameworks through control research, evidence gathering, deliverable review, and documentation
Perform internal audit, assurance testing, and due diligence work, including M&A
Answer complex customer, partner, and prospect security questionnaires within SLA
Build and maintain a reusable answer library using AI-assisted, automated, and manual processes
Drive remediation timelines with Engineering for audit findings and escalate high-risk blockers
Align policies with NIST SP 800-53/CSF, ISO 27001:2022, HIPAA, and SOC 2
Coordinate policy review, approval, publication, and acknowledgment with policy owners, People Operations, and Legal
Monitor regulatory, customer, and threat landscape changes and recommend policy updates
Back up vendor risk, risk exception, and Trust Center activities
Help define and report KPIs and KRIs and support the cyber risk register
Administer Vanta and identify opportunities to automate evidence collection, control monitoring, and framework cross-mapping
Support the security awareness training program

Requirements

What you’ll need

5+ years of experience in GRC, information security risk, compliance, or IT audit, including experience at a SaaS company
A degree in Cybersecurity, or one of these certifications: CISSP, CRISC, CISM, or CISA
SOC 2 Type II and ISO 27001 audit and attestation experience
Clear written and verbal communication, with the ability to explain technical control details to engineers, business owners, and customers
Track record of getting results through influence with engineers and other stakeholders who don't report to you
Hands-on experience in at least four of these areas: security policy and standards; GRC operations; third party and vendor risk management; cyber and technology risk assessment and risk exceptions; risk registers and risk reporting; customer trust work; running an audit or assessment; security assurance
Experience with FedRAMP, NIST 800-53, or other government compliance frameworks
Hands-on configuration of a modern GRC platform such as Vanta, Drata, OneTrust, Archer, or ServiceNow
Experience automating control monitoring and evidence collection
Experience answering customer security questionnaires at scale with AI-assisted tools
GRC experience at a cybersecurity, identity, or infrastructure software company serving regulated industries
Familiarity with AI governance frameworks such as ISO 42001 or NIST AI RMF
Experience with M&A due diligence or IPO readiness, audit test plan development, quantitative cyber risk analysis, business continuity, incident response, or continuous monitoring plans
U.S. citizenship

Benefits

Comp & perks

Hybrid work model: up to three days per week onsite and the remaining days remotely
AI and GRC tooling, including Vanta
Global team environment
Healthy work-life balance
Growth opportunities
Employee experience focused on purpose, growth, and balance